From 16ecde282c31b59af582cbbff8ace078fea3de49 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 8 Sep 2026 22:53:50 -0400 Subject: [PATCH] fix(deps): raise hono floor to ^4.13.7, clearing three moderate advisories `npm audit` at release time reported hono <=4.13.4 against three moderate advisories: GHSA-gqvv-2mrq-wpjv (toSSG() writes outside the output dir), GHSA-g6gw-c38x-mqfc (unbounded dot-notation nesting in parseBody() can exhaust memory) and GHSA-crvj-82cr-hjcx (the query parser reads parameters after the URL fragment, creating cache-key and proxy differentials). hono is a runtime dependency of `core/`, so the fix raises the declared floor rather than only moving the lockfile: a published install resolves this range from the root manifest, and `^4.13.1` would still have let a consumer land on a vulnerable 4.13.x. Refs #2300 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01RsmR1iQstcrEzJFmgZXGLi Signed-off-by: cliffhall --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index ee754a1d..abf3eed0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,7 +22,7 @@ "atomically": "^2.1.1", "chokidar": "^4.0.3", "commander": "^13.1.0", - "hono": "^4.13.1", + "hono": "^4.13.7", "ink": "^6.0.0", "open": "^10.2.0", "pino": "^9.14.0", @@ -3160,9 +3160,9 @@ } }, "node_modules/hono": { - "version": "4.13.1", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.1.tgz", - "integrity": "sha512-kdJoFVv2xmayw6cY09H7AbMJMt8Jn5jdlEdXsP7AGBdF2DIptVlKlOLKXP41yPip4/a3yQPv9gVcJYI8YY04dw==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "license": "MIT", "engines": { "node": ">=16.9.0" diff --git a/package.json b/package.json index 0614b518..41b5d663 100644 --- a/package.json +++ b/package.json @@ -99,7 +99,7 @@ "atomically": "^2.1.1", "chokidar": "^4.0.3", "commander": "^13.1.0", - "hono": "^4.13.1", + "hono": "^4.13.7", "ink": "^6.0.0", "open": "^10.2.0", "pino": "^9.14.0",